bug-bounty
(7)
The Security Company That Taught a Million Hackers - Then Gave Burp a Brain
Burp Suite grew from a hobby project with comic sound effects into the daily workbench of web-security professionals. PortSwigger’s real trick is the loop behind it: discover an attack, turn it into a tool, then teach the world how it works.
HackerOne Made a Business Out of Inviting Strangers to Break In
The bet sounded reckless: give hackers permission, set a bounty, and listen. One Pentagon pilot and hundreds of thousands of validated vulnerabilities later, HackerOne is trying to turn that human network into a continuous, AI-assisted security system.
Bugcrowd Built a Switchboard for Hackers - Now It Wants to Put AI on the Line
Bugcrowd turned an awkward corporate question - how do you invite strangers to attack your software safely? - into a managed marketplace. Its next wager is that machines should cover the map while human hackers chase the strange paths through it.
Nebula Security
Nebula Security is an AI-native cybersecurity company from Y Combinator's Summer 2026 batch. Founded by world-class hackers - members of the world's #1 CTF team r3kapig, DEF CON finalists, Black Hat speakers, and a cybersecurity PhD - it pairs an autonomous code-scanning agent called VEGA with human expertise to audit software for vulnerabilities, from code-level bugs to architectural weaknesses. The team has earned $400K+ in bug bounties exploiting the Linux kernel and Chrome, and reported over a thousand vulnerabilities. Its pitch: 'Attackers already have AI. Get VEGA now.'
Cobalt
Cobalt is the pioneer of Pentest as a Service (PtaaS), pairing a curated community of vetted offensive-security experts (the Cobalt Core) with a SaaS platform that turns penetration testing from a months-long procurement exercise into an on-demand, continuous program. Founded in 2013, the company now serves 1,500+ customers and is leaning hard into AI-augmented offensive security.
Ivan Novikov
Ivan Novikov is the founder and CEO of Wallarm, an AI-powered API security platform that has raised over $70 million in funding including a $55M Series C in 2025. With 24+ years in cybersecurity, he is recognized as the inventor of memcached injection attacks and a pioneer of SSRF research, having earned bug bounty awards from Google, Facebook, Twitter, Tesla, and Yandex. A Y Combinator S16 alumnus with a physics background from Moscow State University, Novikov transformed hands-on offensive security expertise into a company protecting APIs for enterprises worldwide.
Jack Cable
Jack Cable is the CEO and co-founder of Corridor, a San Francisco-based AI security startup that raised a $25M Series A at a $200M valuation in March 2026. Before founding Corridor, Cable spent years at CISA architecting the Secure by Design initiative, helped run the Pentagon's bug bounty programs at Defense Digital Service, and ranked in HackerOne's all-time top 100 hackers. Named to TIME's 25 Most Influential Teens in 2018 at age 17, he started identifying software vulnerabilities at 15 and hasn't stopped since.